Skip to main content

BitLocker - Missing Key Protectors

Summary​

This monitor set detects computers where BitLocker is enabled and the drive is fully encrypted but does not have any key protectors.

Dependencies​

Monitor Setup Location​

Monitors Path: ENDPOINTS ➞ Alerts ➞ Monitors

Monitor Summary​

Fill in the mandatory columns on the left side

  • Name: BitLocker - Missing Key Protectors
  • Description: The monitor set detects computers where BitLocker is enabled and the drive is fully encrypted but does not have any key protectors.
  • Type: Script
  • Severity: Critical Impact Results
  • Family: Security

Image

Targeted Resources​

  • Target Type: Device Groups
  • Group Name: BitLocker Enabled

Image2

Conditions​

  • Run Script on: Schedule
  • Repeat every: 1 Hours
  • Script Language: PowerShell
  • Use Generative AI Assist for script creation: False
  • PowerShell Script Editor:
$WarningPreference = 'SilentlyContinue'
Import-Module BitLocker -ErrorAction Stop
$WarningPreference = 'Continue'

$detectedVolumes = Get-BitLockerVolume -ErrorAction Stop | Where-Object {
    $_.MountPoint -match '^[A-Za-z]:$' -and
    $_.VolumeStatus -eq 'FullyEncrypted' -and
    $_.ProtectionStatus -eq 'OFF' -and
    (
        -not $_.KeyProtector -or
        $_.KeyProtector.KeyProtectorId.ToString().Length -lt 2
    )
}

if ($detectedVolumes) {
    $drives = $detectedVolumes | ForEach-Object {
        "$($_.MountPoint) ($($_.VolumeType))"
    }

    return "Detected fully decrypted drive(s) with BitLocker protection OFF and an invalid/missing KeyProtectorId: $($drives -join ', ')"
}
return "No affected BitLocker volumes found."
  • Criteria: Contains
  • Operator: AND
  • Script Output: Detected fully encrypted drive(s) with BitLocker protection OFF
  • Escalate ticket on script failure: False
  • Add Automation: ``

Image3

Ticket Resolution​

  • Automatically resolve: True
  • Script to Run Same Script as Above
  • Criteria: Contains
  • Operator: AND
  • Script Output: Detected fully encrypted drive(s) with BitLocker protection OFF

Image4

Monitor Output​

Output: Generate Ticket

Image5

Completed Monitor​

Image6

Changelog​

2026-06-29​

  • Initial version of the document